auditing-entra-id-with-aadinternals

SUSPICIOUS/HIGH-RISK skill. Its behavior is internally consistent with an offensive Entra ID red-team skill and the install path appears legitimate, so this is not confirmed malware; however, it gives an AI agent dangerous security-testing capabilities including token theft/reuse, SAML forgery, federation backdooring, and impersonation. Treat as high risk and unsuitable for general-purpose agents or unattended execution.

This fragment provides documentation for a dual-use identity exploitation module. It explicitly describes high-impact capabilities—federation backdoor manipulation, SAML token forging, and impersonation—plus privileged token acquisition/caching and authenticated enumeration. While no malicious payload/exfiltration/persistence code is shown here, the described functionality represents a significant security risk if misused, and the likelihood of abuse is high. Confirm assessment requires reviewing the actual module source and behavior in a controlled test environment.

The module is primarily a reconnaissance/automation CLI targeting Microsoft Entra public endpoints for realm/tenant discovery. In the Python recon path, it only performs outbound HTTPS requests to Microsoft and parses/prints returned metadata. The main security risk is in the "run" mode: it dynamically constructs and executes a PowerShell -Command string using user-supplied cmdlet and arguments, and it imports a host-resolved "AADInternals" module. This creates a meaningful risk of command/behavior abuse if inputs are not trusted and a supply-chain/environment risk if the PowerShell module (or its resolution path) is compromised. No direct evidence of overt malware (data theft, persistence, cryptomining, or suspicious outbound to unknown domains) is visible in this snippet.